Identity, Security & Me

It still amazes me that so many of my friends are displaying their date of birth on their public facebook profile.

Don’t they realise how useful this is to potential Identity thief?

Well its finally happened to me.

After been very careful with my credit card details over the years, last week I finally fell victim to Identity Fraud. Yes, whilst checking my credit card transactions online, I noticed a airline ticket that I certainly didn’t buy. A call to my credit card company revealed two further airline transactions that had not yet been posted onto my statement.

Within one day, 3 separate airline tickets had been bought on my card. Fortunately, the bank had noticed something suspicious and put a stop on my card. Of course, i’m fully covered by my credit card company. However, I can’t help thinking now whether my stolen details were a result of something careless I have done or whether it was a problem over which I had no control (i.e. insider fraud). Still, irrespective of which it is, I will be ever more vigilant when my replacement card arrives.

There are some acquisitions within the Identity space that come as no surprise. For example, when Sun acquired Vaau as a knee-jerk reaction to Oracle’s acquisition of BridgeStream (sorry, I had to get that jibe in), it came as no surprise. Equally, as the other independent role management vendors get bought up, that will be expected also. The only slight surprises may come from who buys who.

However, every now and again a complete left field acquisition shocks the industry. This occurred at RSA with Hitachi announcing it had bought a major share in M-Tech. Everyone seems to be talking about it. Burton, Digital ID World, Dave Kearns, Bruce Schneier etc.

What next, Amstrad buying Courion?

I’m sure like me you are constantly getting invitations to the myriad of different social networking/web 2.0 sites out there. Personally, I have accounts on:

Facebook
LinkedIn
MySpace
Naymz
Plaxo
Del.icio.us
ClaimID
Technorati
and i’m sure there are others……

I don’t have the time to keep all of these up to date, never mind joining any more.

Looking specifically at the number of social networks out there, surely there has to be a point when these must start to consolidate their functionality. I can see it has already starting happening to a certain extent.

LinkedIn is designed for business relationships. Plaxo extends that so you can categorise people as either business or friends. Similarly, LinkedIn allows you to write an endorsement for someone, whereas, Naymz whole philosophy is based on reputation and references.

I don’t see how all of these sites can be sustainable as we move further into 2008.

As always, I am constantly talking to new people about Identity Management in the Enterprise. We always talk about the usual topics; provisioning, authentication, authorisation, audit etc. More and more recently I have been asked by people what my thoughts are on OpenID. Previously, these types of discussions were limited to the hardcore ID people such as the Identity Gang. But now, I seem to be getting asked the question more and more by people within the Enterprise. A number of times it has been people who don’t really understand what OpenID is, other than its one of the ‘new terms’. Others are more informed.

So what do I think of OpenID and its application in the Enterprise……

I think OpenID so far has done a lot for pushing forward Identity 2.0 and has seen a reasonable adoption within the ’social internet’ (blogs, wikis etc). There is definately a good use case for its application there. However, organisations have not yet really started to adopt this technology. There have been a couple, including Sun who announced an internal OpenID server for employees last year. However, in the main its uptake has been extremely limited.

I have no doubt that eventually OpenID will start to find a place within the Enterprise. However, at the moment, I really can’t see its application within the arena. The problem that I see Enterprises facing when looking at OpenID is the lack of trust in the Identity provider. Anyone can set up an OpenID server (indeed this blog is one) and use it to sign-on to OpenID enabled sites. However, where is the trust that I am indeed Paul Toal when I hit the target site. For enterprise, cross domain single sign-on, federation based on SAML (and the other standards) provides that pre-defined trust agreement. Clearly, what it lacks (and OpenID goes towards addressing) is the user consent.

As long as the trust issue is outstanding I don’t see why Enterprises would adopt OpenID for any transactions of any value (financial or otherwise). There is a big difference from posting a comment on a blog that I have signed onto with my OpenID Identity, to performing a business transaction with an Enterprise partner using my self-asserted OpenID.

The answer to this might be to ensure Enterprises host the OpenID server so that their partners can be assured of trust. However, isn’t that what standard federation today gives us. Do we actually want our employees deciding whether, as an employee their Identity information can or can’t be shared with other business partners?

Maybe I am missing the point (feel free to correct me), but at the moment, I just don’t see where OpenID fits within the Enterprise.

Technorati Tags: OpenID, federation, enterprise, trust

Recently there has been a lot of coverage in the media on missing Madeleine McCann.

Initially, there was a massive international manhunt and lots of coverage on all types of media (newspapers, television, radio, internet etc). Everyone was backing the McCanns in the search for their daughter, including a number of famous celebrities such as David Beckham and J.K. Rowling.

However, over the past couple of weeks the Portugese police have turned their attention to the McCanns and have made them suspects in the disappearance of their daughter.

My aim here isn’t to discuss the innocence or guilt of Madeleine’s parents. I’m sure there will be plenty of focus on this in the upcoming weeks and months.

My focus is on the McCanns persona. Within the Identity world there is a lot of talk about a person’s persona and how different personas are portrayed to different groups of people. For example, my work persona is quite different from my home persona. However, the recent events with the McCanns goes to prove that we only have so much control over our persona and how we are portrayed to different people. Alot of this influence comes from the media. In the past week I have seen how the British people have slowly started turning against Madeleine’s parents through no direct actions of the McCanns. It is all based on speculation in the media.

So, whilst the McCanns have not changed their public facing persona towards the world, the influence of the media means that people are viewing them very differently than before.

The McCanns are by no means the only example of this. There are examples (mainly celebrities) of this happening time and time again.

It reminds me of the James Bond film, Tomorrow Never Dies, where the media mogul is trying to control people’s reaction by controlling the information that is provided to them through the media.

I do find it quite disconcerting that the media can have such power of people’s lives.

Powered by ScribeFire.

Finally, after much speculation and a couple of leaks on the Internet, Oracle has finally announced that they have bought Bridgestream for their Enterprise Role Management capabilities. Despite Mel’s thoughts that Oracle has paid over the odds for them, I think this is a very good announcement for Oracle.

This acquisition stands to further enhance Oracle’s already comprehensive offering in the Identity and Access Management space and put them in an even stronger position to offer a complete solution.

I am currently in San Francisco (more on that later) finding out more details about both the Bharosa and Bridgestream acquisitions and hopefully will find out the strategy for these two products moving forward.

From a personal point of view, I must say that Oracle is certainly a good place to be working right now around IAM, what with these recent acquisitions and their strategy and vision.

Powered by ScribeFire.

Like Chris, I seem to be following in his footsteps by having recently joined Facebook in my post-30 era (only slightly over 30 i might add).

However, my introduction to his fascinating site came from an invitation from none other than the infamous Pat Patterson. Obviously, I have heard of Facebook before but up until now have never got around to joining it to see what it is all about. Whilst I have a fairly decent sized network (in my opinion) on LinkedIn, I am just setting out on the road to setting up my friends on FB.

I’m feeling very lonely on FB at the moment. Anyone interested in being my friend ………..

http://www.facebook.com/profile.php?id=565438988

Interestingly, whilst I aren’t stalking Chris’s movements, I also recently joined Spock through another invitation I received. However, unlike Chris, I was pleased to see that searching on my name brought my profile back as the top two links. I was also surprised to see that there were another 4 people in the UK with the same name though and that they all seem to have MySpace profiles. I really must get myself one of those.

Technorati Tags: facebook, social network

I saw in a press release today that Oracle has announced its intention to buy Bharosa. This is a company that specialises in fraud prevention and strong authentication security solutions. This will add the following capabilities to the IAM stack:

• Proactive real time risk-analysis
• Strong authentication
• Fraud prevention

Working within Oracle’s Identity Management team, I see this as a really positive move for Oracle that will provide a real differentiator as well as a strong compliment for the existing products within the IAM suite.

I’m look forward to finding out more about Bharosa’s products in the coming weeks and months.

Technorati Tags: authentication, risk, oracle, identity, access management

Recently I have been involved, at varying levels, in a number of projects centred around federation and primarily federated authentication. Whilst most of my work in the past has been working with the SAML specification, one of the recent projects focused around Shibboleth.

There are a couple of observations I have made when speaking to people about federation.

1. Usually, during client meetings there are several comments about how the solution has to be “Shibboleth compliant” or “SAML compliant”. However, when you dig down a bit further, you usually find that the person dictating this compliance doesn’t fully understand what they are asking for or what it means. For example, when discussing Shibboleth, the discussion moved round to talk about how it uses SAML as its underlying protocol, I asked the client what specific functionality of Shibboleth above and beyond what SAML could give them did they require. The response was very limited. (Note: I’m not particularly picking on Shibboleth here. It just happens to be a recent example). When people ask for SAML compliance, what exactly do they require? Do they plan on using every piece of the spec in its entirety, e.g. SSO, SLO, IdP Discovery etc? Are they planning on using all the bindings, e.g. Artifact, SOAP, POST, PAOS etc. For many companies, it seems to me that compliance with an open standard is sometimes just a tick in the box of an RFI/RFP rather than fully understanding what they are going to use the spec for and what benefits they will gain from its use. For example, does it matter whether a solution (thinking of no particular vendor here) supports the SAML ECP profile. Is this something the client will use in the specific project you are talking to them about.

I think it is important that people who are looking at using federation technologies understand not only what it can do, but also, what options are available within the standards for achieving the end result (including which standards to use). This also includes having an understanding of what the spec doesn’t give you (e.g. how a user authenticates to retrieve their SAML assertion). Whilst this education is the job of the relevant vendors and consultants within the industry, it is also the responsibility of the client to gain that base knowledge.

2. The second observation I has seen is the limited deployments of federated technologies. As I said above, my most recent projects have both been around federation. The plan for my clients was to minimise local user management and benefit from the SSO that you can gain through federation (fairly standard stuff). However, in both cases, when it came down to detailed discussions about the federated partners, it is surprising how many partners are just not in a position to be able to offer support for federated authentication. One particular client was looking at a system designed for approx 300,000 users. They had a local user store to account for a few ‘exceptional’ users who could not authenticate using federated technology (circa 5000 users). However, during detailed design, the number of local users rose drastically to approx 150,000 since several of the federation partners were not ready. This is not unique.

Whilst more and more people are looking at using federation in their business, I believe we are very much still at a stage of putting the technology in place and have the clients build the frameworks to support federation. That way, clients can start with a fairly central repository of users, but, over time, as business partners become ‘federation enabled’, the users can be migrated over to the external partners. Its all about flexibilty within the framework and within the architecture and not expecting that all of your Identity Providers and Service Providers will be ready to offer a full federated service from day one.

Technorati Tags: saml, federation, open standards